updating CORS perms
Rack CORS workaround